CVE-2019-11268: UAA SQL Identity Zone Vulnerability
Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and groups in all other identity zones.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-11268?
CVE-2019-11268 is a vulnerability in Cloud Foundry UAA versions prior to 73.3.0 that allows an authenticated malicious user to obtain private information on users, clients, and groups.
How severe is CVE-2019-11268?
CVE-2019-11268 has a severity rating of 4.3, which is considered medium.
How does CVE-2019-11268 affect Cloud Foundry UAA?
CVE-2019-11268 allows an authenticated malicious user with basic read privileges for one identity zone to extend those privileges to all other identity zones and access private information.
What is the affected software version of CVE-2019-11268?
Cloud Foundry UAA versions prior to 73.3.0 are affected by CVE-2019-11268.
How can I fix CVE-2019-11268?
To fix CVE-2019-11268, update Cloud Foundry UAA to version 73.3.0 or newer.